ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Unexpected Starknet collection that user does not want can be minted when user deposit nft.

asefewwexa

Title

Unexpected Starknet collection that user does not want can be minted when user deposit nft.

Line of code

https://github.com/Cyfrin/2024-07-ark-project/blob/273b7b94986d3914d5ee737c99a59ec8728b1517/apps/blockchain/ethereum/src/Bridge.sol#L115

Vulnerability Details

When user deposit nft using the function Starklane::depositTokens(), they may expect certain collection on Starknet is minted.

function depositTokens(
uint256 salt,
address collectionL1,
snaddress ownerL2,
uint256[] calldata ids,
bool useAutoBurn
)
external
payable
{
...
...
req.collectionL1 = collectionL1;
@> req.collectionL2 = _l1ToL2Addresses[collectionL1];
​
...
...
}

The collection will be minted on L2. But when the user submit the deposit token transaction, that _l1ToL2Addresses[collectionL1] can change, either because admin overwrite and update collection address, or it is because a collectionL2 is deployed.

Impact

user does not mint the nft they want.

Tools Used

Manual Review

Recommendations

We recommend the following change in the Starklane::depositTokens():

function depositTokens(
uint256 salt,
address collectionL1,
snaddress ownerL2,
uint256[] calldata ids,
address expectedCollectionAddress, // add one parameter here
bool useAutoBurn
) {
​
+ if(_l1ToL2Addresses[collectionL1] != expectedL2NFT) {
+ revert("Unexpected Starknet mint can be minted");
+ }
...
...
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.